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ABSTRACT OF THE DISCLOSURE 


The present invention provides a computer program product, method and data 
processing apparatus for reviewing files for potential malware. The computer 
program product comprises logging code operable to maintain a statistical log having 
an entry for each file sent for review, each entry being arranged to store a count value 
indicating the number of times that the file has been sent for review and a value of one 
or more predetermined attributes relating to the file. Weighting table code is also used 
to maintain a weighting table identifying, for each value of said one or more 
predetermined attributes, a weighting indicating the likelihood that a file having that 
value of the one or more predetermined attributes will be malware. The computer 
program product flirther comprises statistical log interface code operable, upon receipt 
of a file, to determine with reference to the statistical log the count value relating to 
that file, and action determination code operable, if the count value determined by the 
statistical log interface code exceeds a predetermined threshold, to reference the 
weighting table to determine the weighting to be associated with the file, based on the 
value of said one or more predetermined attributes associated with that file in the 
statistical log. Finally, action performing code is provided to perform predetermined 
actions in relation to the file depending on the weighting determined by the action 
determination code. It has been found that this technique is useful in identifying files 
that may potentially contain malware. 


